An EU candidate country since 2014, Albania has been eagerly embracing its digital revolution with the government ushering in an array of cyber and digital policy initiatives. In recent years, Albania has worked on adapting its legal framework to comply with the EU’s acquis communautaire and further approach the Digital Single Market. The Albanian policy framework ranks 1^st across the Western Balkans region in fostering the inclusivity and competitiveness of digital society [x], while the country currently ranks 80^th in the Global Security Index [x]. An OECD report praised Albania for enhancing intragovernmental cooperation, emphasising the cross-cutting character of ICT in its development strategies, and allocating resources towards the implementation of its digital strategy. Despite the proliferation of such policies, however, the country is currently the 5^th largest source of cybercrime in Europe, suffering at least 1.3 million cyberattacks yearly [x]. As such, modernising cybercrime legislation and upgrading critical infrastructure protection constitute key priorities for Albanian policymakers.

The United Kingdom ranks 10^th in the 2021 Network Readiness Index (NRI), 9^th in the 2021 Digital Skills Gap Index and 14^th in the 2021 IMD World Digital Competitiveness Ranking. The British digital sector contributes roughly £149 billion each year to the economy and employs more than 1.5 million people [x]. The country also remains Europe’s unofficial ‘start-up capital’, with British tech startups attracting more than $15 billion in venture capital investment in the midst of a global pandemic. Nevertheless, new and emerging challenges to peace and security in cyberspace represent pressing concerns for the UK [x]. Over the course of 2021, the UK’s National Cyber Security Centre dealt with 777 significant incidents, with around 20% of supported organisations being linked to the health sector and Covid vaccines [x]. In the face of ever-increasing cyber vulnerabilities, the UK government has recently adopted a strategy of ‘levelling up’ protection for British cyberspace. This has brought international collaboration on cyber issues to the forefront of Britain’s diplomatic agenda. British diplomacy has traditionally championed the rules-based international system both online and offline, placing great emphasis on human rights, democratic values and free trade.

The digital economy is amongst the most powerful loci of Canadian economic growth; over the past decade, the digital economy grew roughly 40 per cent faster than – and generated almost four times as many jobs as – the overall economy. However, this spurt has also led to increased vulnerabilities in relation to cybersecurity; in 2020, successful cyber attacks affected 78% of Canadian companies. Canada has quietly developed a robust cyber diplomacy approach aiming at promoting a rules-based international order in cyberspace, in line with the goals of other ‘like-minded’ states (including European Union countries). Both the EU and Canada share a vision of cyberspace as a domain of human activity that is open, free, and secure, and which is characterized by due regard for fundamental rights and democratic values. As such, Canada is an important strategic partner for Europe.

At the first substantive session of the 2021-2025 UN Group of Governmental exports (UNGGE), Albania aligned itself with the EU’s statement that the existing corpus of international law, notably the UN Charter, international humanitarian law, and international human rights law, apply in cyberspace in its entirety. In particular, this includes the principle of state sovereignty, sovereign equality, the settlement of disputes by peaceful means, the provision of the use of force non-intervention in the internal affairs of other states, and the respect for human rights and fundamental freedoms as principles of international law that are applicable to states use of ICTs in cyberspace. [x] Albania has also consistently aligned itself with the EU position in a number of key resolutions at the United Nations, including resolutions A/73/27 and A/74/29. A 2015 policy paper notes that cybersecurity will only be “efficient” if it is “based on the fundamental human rights and freedoms, pursuant to the Charter of Fundamental Rights of the European Union and the universal values of the EU”. In the same vein, the 2020-2025 National Cybersecurity Strategy includes “improving the legal framework providing norms and regulating cybersecurity in the country, and aligning this framework with European Union directives and regulation” as a stated objective.

The UK views international law as “a critical tool for ensuring stability and security in cyberspace”. In accordance with the 2013, 2015 and 2021 UNGGE reports as well the 2021 OEWG report, the UK has affirmed that international law, including the UN Charter in its entirety, applies in cyberspace; a position paper notably states that “we do not consider it is for States to pick and choose which international law instruments are applicable”. This includes the prohibition of the use of force (Article 2(4)), the peaceful settlement of disputes (Article 33) and the inherent right of states to act in self-defence in response to an armed attack (Article 51). The law of state responsibility applies to cyber operations in peacetime, including the doctrine of countermeasures in response to internationally wrongful acts. Meanwhile, the country has professed a strong commitment to the respect of human rights law in cyberspace, co-sponsoring the 2012, 2014, 2016, 2018 and 2021 UN Human Rights Council resolutions on the protection, promotion and enjoyment of human rights on the Internet. Likewise, the UK believes in the application of international humanitarian law (IHL) to cyber operations in armed conflict. In response to concerns expressed by other states that this might lead to an undue ‘militarisation’ of cyberspace, the UK has responded that the application of IHL does not encourage armed conflict but only serves to limit humanitarian consequences in the event of such conflict. In addition, the country has stated and that there are ways for cyber capabilities to be developed in a manner “consistent with international law” and called on states to be transparent about the existence of their own capabilities. Those statements do not entirely dismiss the idea of cyberspace as a new military domain, with the British position at the OEWG being that “the use of ICTs in military contexts may be preferable to use of kinetic weapons and can be de-escalatory”. The UK is against the establishment of new, binding international instruments to regulate state behaviour in cyberspace, arguing that “pursuing […] the development of new treaties is only likely to entrench existing divides in this area and will progress us no further on the question of how International Law applies”.

As per the conclusions of the 2013, 2015, and 2021 UN GGE (Group of Governmental Experts) reports, Canada believes that international law applies in cyberspace and is “essential to maintaining peace and stability” as well as “promoting an open, secure, peaceful, and accessible ICT environment”; according to Canada, the applicability of international law “puts guardrails on states’ behaviour in cyberspace”. Applicable legal instruments include the UN Charter, the law on state responsibility (including countermeasures), International Human Rights Law, and International Human Rights Law (IHL). Canada does not favour the establishment of a treaty or binding legal instrument on cyber issues, arguing that it would undermine existing international law and norms of responsible state behaviour. Instead, Canada believes that existing international law and agreed-upon norms are sufficient to guide State behaviour in cyberspace.

At the first substantive session of the 2021-2025 UNGGE, Albania aligned itself with the EU’s position that the previous UNGGE and OEWG reports, including corresponding UNGA resolutions adopted by consensus” form the unequivocal basis for “any further discussions on the position, role, and implementation of the voluntary non-binding norms, rules and principles of state behaviour in cyberspace (norms)” [x]. In 2018, Albania voted against the Russian-sponsored resolution A/73/27, which launched the Open-Ended Working Group (OEWG) format.

The UK regards voluntary, non-binding norms of responsible state behaviour as one of the three key pillars upon which the framework for international stability in cyberspace is currently built, the other two being international law and confidence-building measures (CBMs). The British have argued that “stronger awareness and understanding by all countries of the framework in general” is necessary and stated that they “remain concerned that the elaboration of new norms could undermine the existing norms by weakening the overarching protection they provide, or their technology neutral and ‘future-proofed’ nature”. The focus should instead be on the universalisation, operationalisation and implementation of existing norms, with regional organisations and capacity-building efforts playing a central role in this endeavour.

Canada regards the applicability of norms of responsible state behaviour in cyberspace, together with existing international law, as the “foundation of sustaining international peace and security […] in cyberspace”. This is why it has strongly promoted the adoption and implementation of the UN GGE norms in various fora, including the G7, G20, North American Leaders’ Summit, NATO, ASEAN, and the OSCE. From Canada’s perspective, there is no need to develop new norms; international cooperation efforts should instead focus on fostering States’ capacity-building abilities, as well as the implementation and operationalization of existing norms. Canada has also been the biggest proponent of taking gender considerations into account when discussing the implementation of cyber norms, advocating for greater women’s participation and gender equality in the field of cybersecurity.

In recent years, Albania has significantly expanded its capacity-building activities, modernising both the relevant institutional apparatus and the diplomatic outreach accompanying it. Since 2017, ALCIRT, Albania’s national CSIRT, has been given an expanded mandate and merged with the National Authority for Electronic Certification and Cyber Security (AKCESK). AKCESK is responsible for preparing strategic documents relating to cybersecurity, drafting legislation, collaborating with relevant stakeholders (international organisations, civil society organisations, the private sector) and providing training. [x] Through AKCESK, Albania has signed Memoranda of Understanding (MOU) with several regional national CERTs (Kosovo, North Macedonia, Romania) and is currently negotiating similar MoUs with Serbia, Montenegro, Cyprus, and Slovenia. [x] AKCESK also frequently collaborates with the Council of Europe in relation to incident response and awareness training. [x] As a member of NATO, Albania signed the MoU with the NATO Cyber Incident Response Centre (NCIRC) on enhancing cyber defence in 2013 [x] and has participated in numerous NATO-led training initiatives, including the flagship Cyber Coalition exercise. Meanwhile, increased emphasis has been placed on the protection of critical infrastructure, with a 2015 government paper stating that future actions will be focused on “the protection and resilience capacity of critical infrastructure” and on “encouraging operators that own them to implement a full security architecture (including risk management and emergencies)”. [x] In 2020, Albania adopted its first-ever cybersecurity regulation for the electricity sector, which establishes incident reporting and assessment criteria for electricity operators. [x] This was reportedly only the first of many planned initiatives intended to reduce the country’s cyber vulnerabilities and increase trust in digital services.

The July 2021 policy paper on Global Britain in a Competitive Age makes extensive reference to resilience in the post-Covid ICT environment, pledging that the UK will “strengthen global resilience” and “ensur[e] that more resilient countries worldwide can come together through stronger international institutions to act on the most pressing shared challenges”. In the cyber domain, this pledge has been further operationalised by the 2022 National Cyber Strategy, which frames cyber resilience in terms of risk awareness, system security and preparedness. The Strategy prioritises capacity building, adopting a whole-of-government approach and focusing on three elements: protecting critical international supply chains and infrastructure, advancing the secure use of digital technologies and working with industry partners and academia. Since 2016, the UK has worked through the National Cyber Security Centre (NCSC) to adopt an integrated approach to cyber incident management, streamlining across the public and private sectors. Meanwhile, Britain has championed
capacity-building assistance efforts abroad by providing advice, training and exercises and enabling the creation and maintenance of national Computer Security Incident Response Teams (CSIRTs). It has also provided funding to international capacity-building platforms, such as the Forum of Incident Response & Security Teams (FIRST) and the Americas CSIRT network. The UK has been working with partners within the OSCE to encourage the implementation of confidence-building measures (CBMs).

The Canadian National Cyber Security Strategy puts an emphasis on “secure and resilient Canadian systems”, specifically critical infrastructure such as electricity grids, communications networks, and financial institutions. The ambition to help other countries expand their capacity building activities has been a key aspect of Canada’s cyber engagement strategy and its concurrent aim of promoting an “open, secure, and multistakeholder-led Internet”. Under the auspices of the OEWG, Canada has argued that “member States must make cyber security capacity development a priority at the highest level” and that “it is […] important to analyze and assess the capacity building needs collaboratively and agree on a collective approach”. Through the Anti-Crime Capacity Building Program (ACCBP), Canada has committed $27.7M to cyber capacity building, primarily in Latin America. ACCBP also assists countries in developing their own national cyber strategies and cybersecurity standards while also ensuring respect for human rights and privacy for all citizens. Meanwhile, Canada has been cooperating with several international and regional organizations on the development and implementation of Confidence-Building Measures (CBMs); for instance, there have been several Canadian initiatives at the OSCE, including workshops on international law and cyber operations as well as scenario-based discussions on CBM 5 (information sharing about national responses to regional cyber incidents). Canada believes that capacity-building should be multistakeholder and integrate the insights of the technical community as much as possible. The Canadian representative at the OEWG has also highlighted the importance of gender balance and the participation of women in capacity-building efforts.

Albania is a party to the Budapest Convention on Cybercrime, with the Albanian Parliament ratifying the Convention in 2002 [x]. Since then, however, national strategic documents have been acknowledging the incomplete harmonisation of national legislation with Budapest provisions. The most recent five-year National Cybersecurity Strategy states that “legislation in the cybersecurity field should be harmonised with EU legislation, thus creating a complete and codified mechanism to adequately address and resolve issues. Besides, where possible, international internet security mechanisms should be accessed, signed, ratified, and implemented”. The Strategy also places special emphasis on children’s online protection, elevating it into a key priority [x]. Aiming to implement the policy goals listed within the National Cybersecurity Strategy, the Strategy for Investigation of Cybercrime (2021-2025) lays out a number of objectives for law enforcement [x]: (1) extending the cybercrime investigation structure throughout the country and building technological and legal capacity; (2) presenting a prompt and efficient response to cybercrime, raising public awareness, taking legislative initiatives, and building professional capacity; (3) presenting a rapid and professional response to the prevention, prosecution, and investigation of cybercrime against children; and (4) increasing national and international cooperation in the field of cybercrime investigation with strategic partners. Albanian police forces have also collaborated with Europol in coordinated action against cyber fraud and through the launch of the Sell Safe awareness campaign. [x]

According to the 2022 National Cyber Strategy, the UK is committed to promoting the Council of Europe’s Budapest Convention on cybercrime as the primary international instrument for inter-state cooperation, while simultaneously engaging constructively with the UN process to develop a new international cybercrime treaty that will sit comfortably alongside the Budapest regime. In terms of law enforcement, the UK has developed well established mechanisms through the National Cyber Crime Unit (NCCU), operating under the umbrella of the National Crime Agency (NCA). The NCCU is tasked with leading the operational response, coordinating activity across different stakeholders and providing specialist cyber support across the law enforcement domain. The NCA has also developed a network of international liaison officers, which regularly cooperate with Interpol and Europol. Bilateral cooperation with international partners occurs on the basis of the Budapest Convention and associated Mutual Legal Assistance Treaties (MLATs), which facilitate information sharing amongst signatory states. The UK has been an active participant – and has provided voluntary contributions – in the context of discussions for developing a Second Additional Protocol to the Convention to enhance the speed and efficiency of international evidence sharing; the Protocol will be opened for signature in May 2022. The UK has also provided capacity-building assistance to over 100 partner countries, especially in Eastern Europe, Southeast Asia and Africa.

Canada’s National Cyber Security Strategy identifies the activities of malicious cyber actors as a “growing challenge”. Following the adoption of the ‘Protecting Canadians from Online Crime’ Act, Canada acceded to the Council of Europe’s Budapest Convention in 2015 and has since consistently promoted the instrument as the “best tool to fight cybercrime at the international level”. Canada has specifically “encourage[d] countries to bolster their anti-cybercrime efforts by becoming Parties to the Convention, or using it as a model to implement their own cybercrime laws”. Moreover, upon Canada’s initiative, the Quintet of Attorneys General (which brings together Attorneys General from Canada, the US, Australia, New Zealand and the UK) issued a public statement at their July 2019 meeting, expressing their support for the Budapest Convention as a “necessary basic framework for fighting cybercrime” and for the work of the United Nations Open-Ended Intergovernmental Expert Group on Cybercrime (UNIEG). Being part of the ‘like-minded’ group of states, Canada voted against the Russian-sponsored UNGA Resolution 74/247 aiming at establishing an alternative cybercrime instrument; upon the passage of 74/247 and its follow-up UNGA Resolution 75/282, however, Canada has been a vocal member of the Ad Hoc Committee on Cybercrime. Prior to the Committee’s May 2021 organizational session, the Canadian position paper on the Implementation of 74/247 noted that the Committee must “ensure consistency with existing UN treaties in the field of crime prevention and criminal justice, in particular the United Nations Convention against Transnational Organized Crime, the United Nations Convention against Corruption and take into account multilateral instruments that have already proven their usefulness in the fight against cybercrime, in particular the Council of Europe Convention on Cybercrime”. In the same document, Canada emphasized the need for an “inclusive, transparent, constructive, and consensus-based process that will lead to a fair outcome to the benefit of all”. The first session of the Ad Hoc Committee will be held in New York from 17 to 28 January 2022. Canada’s perspective on the scope, objectives, and structure of the convention was submitted to the Ad Hoc Committee in advance of the start of the first negotiation session (E).